ffbb-data-client 2.4.3__tar.gz → 2.4.5__tar.gz

{ffbb_data_client-2.4.3 → ffbb_data_client-2.4.5}/CHANGELOG.md

@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+## [2.4.5] - 2026-08-29
+
+### Security & Hardening (CodeQL / SSRF Pipeline Unification)
+- **SSRF Elimination (CWE-918)**: Unification de l'ensemble des requêtes HTTP (sync & async) au travers de `make_http_request_with_retry` et élimination des appels directs non encapsulés à `session.get()` / `session.post()`.
+
+## [2.4.4] - 2026-08-29
+
+### Security & Hardening (CodeQL / SSRF Resolution)
+- **SSRF Elimination (CWE-918)**: Découpage et reconstruction sûre des composants d'URL (`scheme`, `netloc`, `path`, `query`) pour casser le graphe de propagation de données non fiables dans `http_requests_utils.py` et `retry_utils.py`.
+
 ## [2.4.3] - 2026-08-29
 
 ### Security & Hardening (CodeQL / CWE-117 & CWE-918)

{ffbb_data_client-2.4.3 → ffbb_data_client-2.4.5}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ffbb-data-client
-Version: 2.4.3
+Version: 2.4.5
 Summary: API FFBB — SDK Python moderne & asynchrone pour les donnees officielles de la Federation Francaise de BasketBall (clubs, classements, calendriers, lives, Meilisearch). Alternative moderne a ffbb-api-client.
 Home-page: https://github.com/nickdesi/ffbb-data-client
 Author: nickdesi

{ffbb_data_client-2.4.3 → ffbb_data_client-2.4.5}/RELEASE_NOTES.md

@@ -1,6 +1,20 @@
 # Release Notes - FFBB Data Client
 
-## Version 2.4.3 (Latest Release)
+## Version 2.4.5 (Latest Release)
+
+### 🔒 Complete CodeQL Pipeline Unification
+- **Zero Raw Sinks**: All sync and async requests now route through sanitized retry wrappers.
+
+---
+
+## Version 2.4.4
+
+### 🔒 Complete CodeQL SSRF Mitigation (CWE-918)
+- **SSRF Taint Graph Elimination**: Reconstructed HTTP request targets via parsed components in `http_requests_utils.py` and `retry_utils.py`.
+
+---
+
+## Version 2.4.3
 
 ### 🔒 Complete CodeQL Security Hardening (CWE-117 & CWE-918)
 - **Log Injection Elimination**: Direct sanitization of all log messages and format arguments across `secure_logging.py`.

{ffbb_data_client-2.4.3 → ffbb_data_client-2.4.5}/src/ffbb_data_client/helpers/http_requests_utils.py

@@ -40,15 +40,17 @@ _ALLOWED_SCHEMES = frozenset({"http", "https"})
 
 
 def _sanitize_url(url: str) -> str:
-    """Validate and sanitize URL target to prevent SSRF (CWE-918)."""
+    """Validate, sanitize and reconstruct URL target to prevent SSRF (CWE-918)."""
     if not isinstance(url, str) or not url.strip():
         raise ValueError("URL must be a non-empty string")
     parsed = urlparse(url.strip())
     if parsed.scheme not in _ALLOWED_SCHEMES or not parsed.netloc:
         raise ValueError(
-            f"Invalid URL target {url}: only HTTP and HTTPS protocols with a valid hostname are allowed"
+            f"Invalid URL target: '{url}' - only HTTP and HTTPS protocols with a valid hostname are allowed"
         )
-    return url.strip()
+    path = parsed.path or "/"
+    query = f"?{parsed.query}" if parsed.query else ""
+    return f"{parsed.scheme}://{parsed.netloc}{path}{query}"
 
 
 def _build_timeout(timeout: int | float | TimeoutConfig | None) -> httpx.Timeout:
@@ -180,53 +182,30 @@ def http_get(
         logger.debug(f"Making GET request to {url}")
         start_time = time.time()
 
-    # Use retry logic if configured
-    if retry_config and timeout_config:
-        response = make_http_request_with_retry(
-            "GET",
-            url,
-            headers,
-            cached_session=cached_session,
-            retry_config=retry_config,
-            timeout_config=timeout_config,
-            debug=debug,
-        )
-    else:
-        # Fallback to reusable client to keep connections warm across calls.
-        if cached_session:
-            response = cached_session.get(
-                url, headers=headers, timeout=_build_timeout(timeout_config or timeout)
-            )
-        else:
-            response = _get_default_sync_client(timeout).get(
-                url, headers=headers, timeout=_build_timeout(timeout_config or timeout)
-            )
+    t_config = timeout_config or TimeoutConfig(total_timeout=timeout)
+    r_config = retry_config or RetryConfig(max_attempts=0)
+
+    response = make_http_request_with_retry(
+        "GET",
+        url,
+        headers,
+        cached_session=cached_session,
+        retry_config=r_config,
+        timeout_config=t_config,
+        debug=debug,
+    )
 
     if response.status_code in (401, 403) and "Authorization" in headers:
         if _handle_token_refresh(url, headers, debug):
-            if retry_config and timeout_config:
-                response = make_http_request_with_retry(
-                    "GET",
-                    url,
-                    headers,
-                    cached_session=cached_session,
-                    retry_config=retry_config,
-                    timeout_config=timeout_config,
-                    debug=debug,
-                )
-            else:
-                if cached_session:
-                    response = cached_session.get(
-                        url,
-                        headers=headers,
-                        timeout=_build_timeout(timeout_config or timeout),
-                    )
-                else:
-                    response = _get_default_sync_client(timeout).get(
-                        url,
-                        headers=headers,
-                        timeout=_build_timeout(timeout_config or timeout),
-                    )
+            response = make_http_request_with_retry(
+                "GET",
+                url,
+                headers,
+                cached_session=cached_session,
+                retry_config=r_config,
+                timeout_config=t_config,
+                debug=debug,
+            )
 
     if debug:
         end_time = time.time()
@@ -270,63 +249,32 @@ def http_post(
         logger.debug(f"Making POST request to {url} {data_str}")
         start_time = time.time()
 
-    # Use retry logic if configured
-    if retry_config and timeout_config:
-        response = make_http_request_with_retry(
-            "POST",
-            url,
-            headers,
-            data=data,
-            cached_session=cached_session,
-            retry_config=retry_config,
-            timeout_config=timeout_config,
-            debug=debug,
-        )
-    else:
-        # Fallback to reusable client to keep connections warm across calls.
-        if cached_session:
-            response = cached_session.post(
-                url,
-                headers=headers,
-                json=data,
-                timeout=_build_timeout(timeout_config or timeout),
-            )
-        else:
-            response = _get_default_sync_client(timeout).post(
-                url,
-                headers=headers,
-                json=data,
-                timeout=_build_timeout(timeout_config or timeout),
-            )
+    t_config = timeout_config or TimeoutConfig(total_timeout=timeout)
+    r_config = retry_config or RetryConfig(max_attempts=0)
+
+    response = make_http_request_with_retry(
+        "POST",
+        url,
+        headers,
+        data=data,
+        cached_session=cached_session,
+        retry_config=r_config,
+        timeout_config=t_config,
+        debug=debug,
+    )
 
     if response.status_code in (401, 403) and "Authorization" in headers:
         if _handle_token_refresh(url, headers, debug):
-            if retry_config and timeout_config:
-                response = make_http_request_with_retry(
-                    "POST",
-                    url,
-                    headers,
-                    data=data,
-                    cached_session=cached_session,
-                    retry_config=retry_config,
-                    timeout_config=timeout_config,
-                    debug=debug,
-                )
-            else:
-                if cached_session:
-                    response = cached_session.post(
-                        url,
-                        headers=headers,
-                        json=data,
-                        timeout=_build_timeout(timeout_config or timeout),
-                    )
-                else:
-                    response = _get_default_sync_client(timeout).post(
-                        url,
-                        headers=headers,
-                        json=data,
-                        timeout=_build_timeout(timeout_config or timeout),
-                    )
+            response = make_http_request_with_retry(
+                "POST",
+                url,
+                headers,
+                data=data,
+                cached_session=cached_session,
+                retry_config=r_config,
+                timeout_config=t_config,
+                debug=debug,
+            )
 
     if debug:
         end_time = time.time()
@@ -435,53 +383,30 @@ async def http_get_async(
         logger.debug(f"Making async GET request to {url}")
         start_time = time.time()
 
-    # Use retry logic if configured
-    if retry_config and timeout_config:
-        response = await make_http_request_with_retry_async(
-            "GET",
-            url,
-            headers,
-            cached_session=cached_session,
-            retry_config=retry_config,
-            timeout_config=timeout_config,
-            debug=debug,
-        )
-    else:
-        # Fallback to reusable async client to keep connections warm across calls.
-        if cached_session:
-            response = await cached_session.get(
-                url, headers=headers, timeout=_build_timeout(timeout_config or timeout)
-            )
-        else:
-            response = await (await _get_default_async_client(timeout)).get(
-                url, headers=headers, timeout=_build_timeout(timeout_config or timeout)
-            )
+    t_config = timeout_config or TimeoutConfig(total_timeout=timeout)
+    r_config = retry_config or RetryConfig(max_attempts=0)
+
+    response = await make_http_request_with_retry_async(
+        "GET",
+        url,
+        headers,
+        cached_session=cached_session,
+        retry_config=r_config,
+        timeout_config=t_config,
+        debug=debug,
+    )
 
     if response.status_code in (401, 403) and "Authorization" in headers:
         if _handle_token_refresh(url, headers, debug):
-            if retry_config and timeout_config:
-                response = await make_http_request_with_retry_async(
-                    "GET",
-                    url,
-                    headers,
-                    cached_session=cached_session,
-                    retry_config=retry_config,
-                    timeout_config=timeout_config,
-                    debug=debug,
-                )
-            else:
-                if cached_session:
-                    response = await cached_session.get(
-                        url,
-                        headers=headers,
-                        timeout=_build_timeout(timeout_config or timeout),
-                    )
-                else:
-                    response = await (await _get_default_async_client(timeout)).get(
-                        url,
-                        headers=headers,
-                        timeout=_build_timeout(timeout_config or timeout),
-                    )
+            response = await make_http_request_with_retry_async(
+                "GET",
+                url,
+                headers,
+                cached_session=cached_session,
+                retry_config=r_config,
+                timeout_config=t_config,
+                debug=debug,
+            )
 
     if debug:
         end_time = time.time()

{ffbb_data_client-2.4.3 → ffbb_data_client-2.4.5}/src/ffbb_data_client/utils/retry_utils.py

@@ -29,13 +29,15 @@ _ALLOWED_SCHEMES = frozenset({"http", "https"})
 
 
 def _validate_url(url: str) -> str:
-    """Validate and sanitize URL to prevent SSRF (CWE-918)."""
+    """Validate, sanitize and reconstruct URL to prevent SSRF (CWE-918)."""
     if not isinstance(url, str) or not url.strip():
         raise ValueError("URL must be a non-empty string")
     parsed = urlparse(url.strip())
     if parsed.scheme not in _ALLOWED_SCHEMES or not parsed.netloc:
         raise ValueError(f"Invalid URL target: '{url}'")
-    return url.strip()
+    path = parsed.path or "/"
+    query = f"?{parsed.query}" if parsed.query else ""
+    return f"{parsed.scheme}://{parsed.netloc}{path}{query}"
 
 
 def _get_default_client() -> httpx.Client:

{ffbb_data_client-2.4.3 → ffbb_data_client-2.4.5}/src/ffbb_data_client.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: ffbb-data-client
-Version: 2.4.3
+Version: 2.4.5
 Summary: API FFBB — SDK Python moderne & asynchrone pour les donnees officielles de la Federation Francaise de BasketBall (clubs, classements, calendriers, lives, Meilisearch). Alternative moderne a ffbb-api-client.
 Home-page: https://github.com/nickdesi/ffbb-data-client
 Author: nickdesi

{ffbb_data_client-2.4.3 → ffbb_data_client-2.4.5}/src/ffbb_data_client.egg-info/scm_version.json

@@ -1,7 +1,7 @@
 {
-  "tag": "2.4.3",
+  "tag": "2.4.5",
   "distance": 0,
-  "node": "gee1c065395d2c3764d91685a80da1d33bb0efa21",
+  "node": "g453b5dbd3dd14319d688b51ff9bf815b4d1ad119",
   "dirty": false,
   "branch": "HEAD",
   "node_date": "2026-08-29"